skills/c4-fake-trading-app-investigator/references/workflow.md

# Investigation workflow

## Phase 0 — authority and safety

Confirm investigator role, lawful purpose, jurisdiction, case/reference number if one exists, handling restrictions, and permitted scope. Identify active theft, ongoing contact, threatened self-harm, compromised accounts, exposed credentials, or funds that may still be intercepted. Recommend emergency reporting or institutional escalation without promising recovery.

## Phase 1 — intake and preservation

Build the initial allegation in neutral language: who reported what, when, through which channel, and total claimed loss. Inventory originals before analysis. Ask for the highest-value evidence first: payment records, transaction hashes, app/site identifiers, withdrawal demands, chats, and the complainant's chronology.

## Phase 2 — scheme reconstruction

Reconstruct the funnel: first contact, trust-building, platform onboarding, displayed profits, initial withdrawal if any, escalating deposits, blocked withdrawal, tax/fee/security-deposit demands, and cessation or threats. Record each representation, reliance event, and transfer.

## Phase 3 — entity and infrastructure analysis

Normalize names, phone numbers, emails, handles, bank accounts, UPI IDs, URLs, domains, IPs, app package identifiers, company claims, and support channels. Distinguish asserted identity from verified identity. Preserve volatile domain, DNS, store-listing, and hosted-content observations with collection time.

## Phase 4 — financial and blockchain tracing

Reconcile the loss ledger to independent records. For each crypto transfer, identify chain and asset, validate the transaction, profile relevant addresses, trace immediate flows, record service-attribution candidates, and note mixing, bridges, swaps, internal transactions, and off-chain blind spots. Do not claim beneficial ownership from an address label alone.

## Phase 5 — hypothesis testing

Test at least these explanations when plausible:

- intentionally fraudulent trading interface;
- real but unlicensed or misrepresented service;
- account takeover or impersonation of a legitimate platform;
- complainant misunderstanding, record mismatch, or unrelated loss; and
- laundering layer operated by a different actor.

Record evidence for and against each. Prioritize actions by evidentiary value, urgency, cost, intrusiveness, and dependency.

## Phase 6 — legal and procedural review

Establish incident dates and places before selecting an enactment. Verify current official text, commencement, savings, amendments, cognizability/bailability schedule, State/UT rules, and agency procedure. Map facts to elements and flag missing proof. Keep investigator facts separate from legal review comments.

## Phase 7 — drafting and review

Reconcile totals, dates, names, identifiers, and evidence citations. Run the checkpoint validator. Draft the requested output, surface unresolved gaps, and ask the investigator to confirm factual accuracy. Classify readiness using the SKILL.md gate.

## Investigation cadence

At each turn, prefer the next action that could materially confirm or falsify the leading hypothesis. Avoid long generic checklists. Ask at most three questions, then update the record using the response.